| stage | group | info |
|---|---|---|
Secure |
Dynamic Analysis |
To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments |
By inserting Carriage Return / Line Feed (CRLF) characters, malicious users could potentially inject arbitrary data into HTTP responses. By modifying HTTP responses, attackers could conduct cross-site scripting or cache poisoning attacks against other users of the system.
User input should never be used in constructing HTTP header responses without some form of validation against newlines. This includes URLs supplied by the user for HTTP redirects.
| ID | Aggregated | CWE | Type | Risk |
|---|---|---|---|---|
| 113.1 | false | 113 | Active | high |